diff --git a/.github/workflows/client-integration-tests.yml b/.github/workflows/client-integration-tests.yml
index 991b595..58f94d2 100644
--- a/.github/workflows/client-integration-tests.yml
+++ b/.github/workflows/client-integration-tests.yml
@@ -186,8 +186,24 @@ jobs:
         shell: bash
         run: |
           if [[ "$RUNNER_OS" == "Windows" ]]; then
-            SEARCH_DIR="${LOCALAPPDATA:-$HOME/AppData/Local}"
-            CODEQL_BINARY=$(find "$SEARCH_DIR" -path "*gh-codeql*release*" -name "codeql.exe" 2>/dev/null | head -1)
+            # The gh-codeql extension stores CodeQL distributions under
+            # %LOCALAPPDATA%\GitHub\gh-codeql on Windows (its own data dir),
+            # separate from the GitHub CLI extensions directory.  Search there
+            # first, then fall back to the extensions dir and all LOCALAPPDATA.
+            LOCALAPPDATA_DIR="${LOCALAPPDATA:-$HOME/AppData/Local}"
+            CODEQL_BINARY=""
+            for search_dir in \
+                "${LOCALAPPDATA_DIR}/GitHub/gh-codeql" \
+                "${LOCALAPPDATA_DIR}/GitHub CLI/extensions/gh-codeql" \
+                "${LOCALAPPDATA_DIR}"; do
+              if [[ -d "$search_dir" ]]; then
+                CODEQL_BINARY=$(find "$search_dir" -maxdepth 10 \
+                  -name "codeql.exe" -type f 2>/dev/null | head -1)
+                if [[ -n "$CODEQL_BINARY" ]]; then
+                  break
+                fi
+              fi
+            done
             # Convert MSYS path to Windows mixed-mode path for Node.js
             if [[ -n "$CODEQL_BINARY" ]]; then
               CODEQL_BINARY=$(cygpath -m "$CODEQL_BINARY")
diff --git a/client/package.json b/client/package.json
index f6b1bdb..8b0537e 100644
--- a/client/package.json
+++ b/client/package.json
@@ -53,7 +53,7 @@
     "start": "node src/ql-mcp-client.js integration-tests",
     "test": "npm run test:integration",
     "test:coverage": "echo 'NOOP client test:coverage'",
-    "test:integration": "scripts/run-integration-tests.sh --no-install-packs",
+    "test:integration": "ENABLE_MONITORING_TOOLS=false scripts/run-integration-tests.sh --no-install-packs",
     "test:integration:default": "ENABLE_MONITORING_TOOLS=false scripts/run-integration-tests.sh --no-install-packs",
     "test:integration:http": "MCP_MODE=http scripts/run-integration-tests.sh --no-install-packs",
     "test:integration:install-packs": "scripts/run-integration-tests.sh",
diff --git a/server/scripts/test-codeql-path-valid.sh b/server/scripts/test-codeql-path-valid.sh
index 5c8f507..39ecfc1 100755
--- a/server/scripts/test-codeql-path-valid.sh
+++ b/server/scripts/test-codeql-path-valid.sh
@@ -85,13 +85,21 @@ trap cleanup EXIT
 # Use a long-running stdin feeder as a SEPARATE backgrounded process, then
 # connect it to the server via a named pipe (FIFO) to avoid bash subshell
 # PID issues with `A | B &`.
-FIFO="$(mktemp -u)"
-mkfifo "${FIFO}" 2>/dev/null || {
-  # mkfifo may not exist on Windows Git Bash — fall back to /dev/null stdin.
-  # The server will exit immediately on EOF but we can still check if startup
-  # succeeds before the transport closes.
-  FIFO=""
-}
+#
+# On Windows (MSYS2/Git Bash), mkfifo creates MSYS2-specific named pipes
+# that native Windows processes (node.exe) cannot read from reliably.
+# Force the process-substitution fallback on Windows, which creates a
+# Windows-compatible pipe handle that node.exe can read from correctly.
+FIFO=""
+case "$(uname -s)" in
+  MINGW*|MSYS*|CYGWIN*)
+    # Windows: skip mkfifo — native node.exe cannot read from MSYS2 FIFOs.
+    ;;
+  *)
+    FIFO="$(mktemp -u)"
+    mkfifo "${FIFO}" 2>/dev/null || { FIFO=""; }
+    ;;
+esac
 
 if [[ -n "${FIFO}" ]]; then
   # Feed the FIFO in the background so the server's stdin stays open
@@ -101,7 +109,9 @@ if [[ -n "${FIFO}" ]]; then
   node "${SERVER_BUNDLE}" < "${FIFO}" > /dev/null 2> "${STDERR_FILE}" &
   SERVER_PID=$!
 else
-  # Fallback: use process substitution to keep stdin open
+  # Fallback: use process substitution to keep stdin open.
+  # On Windows, Git Bash converts process substitution into a Windows
+  # pipe handle that node.exe (native process) can read correctly.
   node "${SERVER_BUNDLE}" < <(sleep 30) > /dev/null 2> "${STDERR_FILE}" &
   SERVER_PID=$!
 fi
@@ -140,9 +150,9 @@ if kill -0 "${SERVER_PID}" 2>/dev/null; then
 else
   wait "${SERVER_PID}" 2>/dev/null && EXIT_CODE=0 || EXIT_CODE=$?
 
-  # On Windows, mkfifo is unavailable and the process-substitution fallback
-  # may not keep stdin open reliably.  When the STDIO transport receives EOF
-  # the server shuts down cleanly (exit 0) even though startup succeeded.
+  # On Windows, process substitution may not keep stdin open reliably.
+  # When the STDIO transport receives EOF the server shuts down cleanly
+  # (exit 0) even though startup succeeded.
   # Accept that as a pass when the logs prove the server started correctly.
   if [[ "${EXIT_CODE}" -eq 0 ]] && check_startup_logs; then
     echo ""